Skip to content

Hide Navigation Hide TOC

Disable Powershell Command History (602f5669-6927-4688-84db-0d4b7afb2150)

Detects scripts or commands that disabled the Powershell command history by removing psreadline module

Cluster A Galaxy A Cluster B Galaxy B Level
Disable Powershell Command History (602f5669-6927-4688-84db-0d4b7afb2150) Sigma-Rules Clear Command History - T1070.003 (3aef9463-9a7a-43ba-8957-a867e07c1e6a) Attack Pattern 1
Clear Command History - T1070.003 (3aef9463-9a7a-43ba-8957-a867e07c1e6a) Attack Pattern Indicator Removal - T1070 (799ace7f-e227-4411-baa0-8868704f2a69) Attack Pattern 2